How many agents were configured on this server? Were the agents running version 2.6? Are you using agent-auth? Does your etc/client.keys showing agent IP addresses, or ANY in place of aaa.bbb.ccc.ddd?
On Tuesday, November 20, 2012 8:09:00 AM UTC-8, Francisco Jelves wrote: > > After running OSSEC server upgrade 2.6 to 2.7 final release, the / var / > ossec / logs / alerts / alerts.log is zero bytes. > The following command displays all disconnected agents: if Never connected. > . / agent_control-l > > OSSEC HIDS agent_control. List of available agents: > ID: 000 Name: serverxxx (server) IP: 127.0.0.1, Active / Local > ID: 1024 Name: xxx, IP: any, Disconnected > ID: 1025 Name: xxx, IP: any, Disconnected > ... > ID: 5575, Name: xxx, IP: any, Never connected > ID: 5576, Name: xxx, IP: any, Never connected > > Any recommendations? I'm thinking about going back to 2.6, but I'd like > OSSEC 2.7 server and use your new features. > Thanks a lot, > Frank >
